From 901d72d26b6dc135a41e3901b4690de124665d18 Mon Sep 17 00:00:00 2001 From: David Carlier Date: Sun, 6 Sep 2026 10:24:24 +0100 Subject: [PATCH] media: mali-c55: Check the parameters buffer address before copying mali_c55_params_buf_prepare() copies the parameters buffer supplied by userspace into the driver's scratch buffer, using the result of vb2_plane_vaddr() as the source without checking it. The queue accepts VB2_DMABUF, and vb2_dc_vaddr() returns NULL for an exporter that cannot be vmapped, so the memcpy() dereferences NULL. Reject the buffer at prepare time instead. Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver") Cc: stable@vger.kernel.org Signed-off-by: David Carlier Reviewed-by: Jacopo Mondi Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil --- drivers/media/platform/arm/mali-c55/mali-c55-params.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/media/platform/arm/mali-c55/mali-c55-params.c b/drivers/media/platform/arm/mali-c55/mali-c55-params.c index 70106276b7e4..16e895e3488e 100644 --- a/drivers/media/platform/arm/mali-c55/mali-c55-params.c +++ b/drivers/media/platform/arm/mali-c55/mali-c55-params.c @@ -710,6 +710,9 @@ static int mali_c55_params_buf_prepare(struct vb2_buffer *vb) struct mali_c55 *mali_c55 = params->mali_c55; int ret; + if (!config) + return -EFAULT; + ret = v4l2_isp_params_validate_buffer_size(mali_c55->dev, vb, v4l2_isp_buffer_size(MALI_C55_PARAMS_MAX_SIZE)); if (ret)